@cbeer, as far as I can tell looking at the Rails code, Rails4 is doing something _different_ than what I'm doing, and what I'm doing may not use the 'secure initialization vector'.  I was unable to figure out how to do exactly what Rails is doing, the code is confusing to me and undocumented, and additionally challenging in that it works differently in Rails 3 and Rails 4 and Rails 4.1 and we need BL to work with all of those. 

So I remain not confident that my code such as it's written is secure, or is even as secure as Rails, and I am personally unable to figure out how to make it so.  So I guess the options are:

* Maybe I can figure out how to use the example jcoyne found, but I'm still not sure what to do for Rails pre 4.1 in that case. 
* Can take my code as in this PR, using the separate secret token so if it is insecure, at least it won't compromise Rails secret token (my original idea)
* If you are more confident than me that my code as written is secure even with using Rails standard secret token, and you direct me to do so, I can certainly change my code to do that. it just makes me nervous, but it's your call. 
* You can say you won't accept this PR until I or someone else figures out more about how to use Rails encryption features securely with confidence in Rails 3 through 4.1. I'm afraid that's unlikely to come from me anytime soon, so that would probably mean I'd investigate adding this feature to my app as a local feature or plugin instead (which would be a lot more challenging in some ways, so I'm def not suggesting it as a preferred solution!)